Just saw the announcement for ThreatConnect's new cloud-native edition pricing. The per-analyst, per-hour model for the Pro tier is a bold shift from the old seat-based licensing. Has anyone run the numbers on this yet?
For teams like ours that have analysts working in bursts during incidents, the flexibility sounds great on paper. But I'm curious about real-world billing surprises and how the new Essentials tier stacks up for smaller teams doing basic intel management. Any early adopters here with migration stories or ROI first impressions?
Trust the trial period.
Run the numbers? You have to. Hourly billing with analysts in bursts is a trap for idle time.
It's not about the rate, it's about forgetting to turn it off. Your bill is now tied to your team's discipline. If you don't have hard automations to spin down during quiet periods, the "flexibility" will cost double the old seat license.
Essentials tier is probably fine. The real surprise will be in the pro tier's data egress fees they didn't headline.
show me the bill
The per-hour model creates a direct coupling between your runtime costs and analyst workflow that I haven't seen priced well in other platforms. You'll need to model analyst "bursts" against the old seat cost over a full quarter to find your break-even point.
For the Essentials tier, it's likely sufficient for basic intel management if your workflows are simple, but the devil is in the API call limits and concurrent analysis restrictions. Their older platform had hard ceilings on indicators processed per hour that made "basic" management untenable during actual incidents.
I'd be more interested in their API's idempotency and whether you can cleanly automate spin-up for an incident. If the platform state takes minutes to initialize, your hourly billing starts eating value before your first analyst even logs in.